#!/bin/bash
export KUBE_APISERVER="https://192.168.101.99:8443"
cd /usr/local/kubernetes/ssl
cat > /usr/local/kubernetes/ssl/encryption-config.yaml <<EOF
kind: EncryptionConfig
apiVersion: v1
resources:
  - resources:
      - secrets
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: $(head -c 32 /dev/urandom | base64)
      - identity: {}
EOF
#-----------------------------------------------------------

# 创建kubelet bootstrapping kubeconfig 

# 设置集群参数
kubectl config set-cluster kubernetes \
  --certificate-authority=/usr/local/kubernetes/ssl/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=kubectl.kubeconfig

# 设置客户端认证参数
kubectl config set-credentials admin \
  --client-certificate=/usr/local/kubernetes/ssl/admin.pem \
  --client-key=/usr/local/kubernetes/ssl/admin-key.pem \
  --embed-certs=true \
  --kubeconfig=kubectl.kubeconfig

kubectl config set-context kubernetes \
  --cluster=kubernetes \
  --user=admin \
  --kubeconfig=kubectl.kubeconfig


# 设置默认上下文
kubectl config use-context kubernetes --kubeconfig=kubectl.kubeconfig

cp /usr/local/kubernetes/ssl/kubectl.kubeconfig ~/.kube/config

#这是拷贝到所有master
scp /usr/local/kubernetes/ssl/kubectl.kubeconfig k8s-master2:~/.kube/config


-----------------------------------------------------------------
# 创建kube-proxy kubeconfig文件

kubectl config set-cluster kubernetes \
  --certificate-authority=/usr/local/kubernetes/ssl/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=kube-proxy.kubeconfig

kubectl config set-credentials kube-proxy \
  --client-certificate=/usr/local/kubernetes/ssl/kube-proxy.pem \
  --client-key=/usr/local/kubernetes/ssl/kube-proxy-key.pem \
  --embed-certs=true \
  --kubeconfig=kube-proxy.kubeconfig

kubectl config set-context default \
  --cluster=kubernetes \
  --user=kube-proxy \
  --kubeconfig=kube-proxy.kubeconfig

kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig

----------------------------------------------------------------------
#创建和分发kubeconfig文件
export KUBE_APISERVER="https://192.168.101.99:8443"
kubectl config set-cluster kubernetes \
  --certificate-authority=/usr/local/kubernetes/ssl/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=kube-controller-manager.kubeconfig

kubectl config set-credentials system:kube-controller-manager \
  --client-certificate=/usr/local/kubernetes/ssl/controller-manager.pem \
  --client-key=/usr/local/kubernetes/ssl/controller-manager-key.pem \
  --embed-certs=true \
  --kubeconfig=kube-controller-manager.kubeconfig

kubectl config set-context system:kube-controller-manager \
  --cluster=kubernetes \
  --user=system:kube-controller-manager \
  --kubeconfig=kube-controller-manager.kubeconfig

kubectl config use-context system:kube-controller-manager --kubeconfig=kube-controller-manager.kubeconfig

----------------------------------------------------------------------------------------

export KUBE_APISERVER="https://192.168.101.99:8443"
kubectl config set-cluster kubernetes \
  --certificate-authority=/usr/local/kubernetes/ssl/ca.pem \
  --embed-certs=true \
  --server=${KUBE_APISERVER} \
  --kubeconfig=kube-scheduler.kubeconfig

kubectl config set-credentials system:kube-scheduler \
  --client-certificate=/usr/local/kubernetes/ssl/kube-scheduler.pem \
  --client-key=/usr/local/kubernetes/ssl/kube-scheduler-key.pem \
  --embed-certs=true \
  --kubeconfig=kube-scheduler.kubeconfig

kubectl config set-context system:kube-scheduler \
  --cluster=kubernetes \
  --user=system:kube-scheduler \
  --kubeconfig=kube-scheduler.kubeconfig

kubectl config use-context system:kube-scheduler --kubeconfig=kube-scheduler.kubeconfig
